Notin Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 10, 2026, the ransomware group everest listed Notin on its leak site, claiming to have obtained internal files during a ransomware attack. The number of people potentially affected is not known, and no further details about the volume or contents of any material have been made public. For clients of Spanish notaries that rely on Notin’s systems, the incident raises questions about the security of records that underpin property transactions, wills, and other legal acts.

Breaking down the breach

The only confirmed information is the listing itself and the statement that internal files were allegedly exfiltrated. No date of intrusion, duration of access, or ransom demand has been disclosed. The scale of the operation and whether any data was subsequently published remain unconfirmed.

The group behind it: everest

Everest is a ransomware operation that publicly lists victims on its leak site after claiming to have stolen data during encryption attacks. The group’s standard approach involves both encrypting systems and removing copies of files, then using the threat of publication to pressure organisations. Its listings are presented by the group as evidence of successful intrusions, though independent verification of each claim is not always available.

Notin and its sector

Notin supplies integrated technology services to notaries in Spain, including management software, hardware, maintenance, cybersecurity tools and artificial-intelligence applications. Notarial offices handle official legal instruments that record property ownership, powers of attorney, inheritances and corporate acts. Because these records carry legal weight, the sector processes identifying information and documents that are not easily replaced.

What data was at risk

The listing refers only to “internal files.” The precise categories of information contained in those files have not been disclosed. Organisations of this type commonly store client records, configuration data for notary systems, and operational documents; however, the exact contents taken in this case remain unconfirmed.

Why it matters

Exposure of internal files from a notary-technology provider can affect the confidentiality of legal records that citizens and businesses rely on for transactions with lasting legal consequences. Even without public confirmation of specific data types, the presence of such material outside its intended environment creates ongoing uncertainty for anyone whose documents were processed through Notin-supported systems. The organisation itself faces operational disruption and the need to review access controls and third-party dependencies.

Were you affected?

Individuals can begin by monitoring official communications from their notary and from Notin. A practical first step is to check whether an email address has appeared in any previously published breach data sets through a free exposure scan. Where accounts show signs of prior exposure, enabling multi-factor authentication and reviewing recent logins on financial and government portals reduces the chance of follow-on misuse.

AICompiled with AI assistance from public sources and published under our editorial standards.